The Short Answer
FERPA regulates who may access a student education record and under what conditions. It says nothing about which model processes that record, who trained it, or which jurisdiction the inference runs in — so "FERPA compliant" does not answer the model-provenance question at all. Districts close that gap in the contract, or by removing it: on ibl.ai you own all the code and the data, self-hosted, model-agnostic.
The compliance answer and the architecture answer are different answers to different questions.
What does Qwen passing 3 billion downloads mean for schools?
That open weights are now the substrate under a large share of products, including ones that never mention it. Alibaba's Qwen family crossed 3 billion downloads in six months, overtaking Meta and Google to become the most-downloaded open model family.
The scale of the surrounding ecosystem is the operative detail: Alibaba has released more than 460 open models, and the ecosystem has produced over 300,000 derivative models. By comparison, Google recorded roughly 418 million downloads across 2026 and Meta 227 million.
A derivative model is where provenance gets genuinely hard to trace. A vendor can fine-tune an open model, rename it, and ship it inside a tutoring product with no obligation to disclose the base.
This is not an argument against open models. Open weights are the reason a district can self-host at all — the alternative is renting a closed API, which is worse on every axis discussed here.
It is an argument that "which model is under this product" has become a question a district must ask explicitly, because the market will not volunteer it.
Does FERPA say anything about which model processes student data?
No. FERPA governs education records — who may access personally identifiable information from them, what constitutes disclosure, when written consent is required, and the school-official exception under which a vendor may process records on the district's behalf.
Under that exception the vendor must be under the district's direct control with respect to the records, use them only for the authorized purpose, and not redisclose them. Those are real obligations and they do useful work.
None of them is a statement about model provenance. FERPA does not require disclosure of which model performs the processing, which organization produced its weights, what its training corpus contained, or which country the inference executes in.
That is not a defect in the statute. FERPA was written for records and access to them, and a model is not a record. But it means a vendor can answer "yes, we are FERPA compliant" truthfully while every provenance question remains open.
State student-privacy laws and district data-governance policies can go further, and some do. The point is that the federal floor does not, so a district relying on FERPA alone has not asked the question it thinks it asked.
How can a district find out which model powers its AI tutor?
By requiring it in writing, because there is usually no product surface that reveals it.
Ask for four specifics, and treat vagueness on any of them as the answer:
- Named model and version. "A leading large language model" is not an answer. "Qwen 3, version X, fine-tuned by us" is.
- Inference location. The cloud region and legal jurisdiction where student prompts are processed, not the vendor's headquarters.
- Subprocessor list with change notice. Every party that touches student data, and a contractual commitment to notify before it changes.
- Retention and training use. Whether prompts or outputs are retained, and whether they are used to improve any model.
The reason this matters operationally is that models change under products silently. A vendor that switches its base model mid-year has changed what processes student records without triggering any FERPA event.
What should a K-12 district require in an AI contract?
Contract terms that survive the vendor changing their mind:
- Model pinning with notice. The named model and version may not change without advance written notice and a district right to review.
- Data residency, stated as a location. Not "in compliance with applicable law" but a named region, with a prohibition on processing elsewhere.
- No training on student data, stated as an affirmative prohibition rather than a policy link that the vendor can revise.
- Audit access. The district can obtain records of what the system did with a given student's data, on district timelines.
- Exit terms. Data returned in a usable format, and deletion certified, within a fixed window.
The cost question runs alongside these, because per-seat licensing prices the student roster rather than the usage — the arithmetic is in AI cost math for K-12 districts.
Can a district remove the provenance question entirely?
Yes, by changing where inference happens rather than by asking better questions about someone else's infrastructure.
When the platform runs inside district-controlled infrastructure, the model in use is whichever model the district deployed. Provenance is not a disclosure to request; it is a configuration to read.
Student data does not leave the district's perimeter, so the subprocessor chain that FERPA's school-official exception is designed to constrain has one fewer link in it — or none.
Model-agnostic routing then means the district can run an open model, a commercial model through a private deployment, or swap between them, without renegotiating who processes student records.
Where ibl.ai fits
ibl.ai is the agentic AI platform where you own all the code and the data.
You self-host the entire stack inside your own perimeter, run it model-agnostic across any LLM and switch anytime, and pay by usage with no per-seat pricing — so you can deploy anywhere: your cloud, on-premise, GovCloud, or fully air-gapped.
For a district that means student records stay inside district infrastructure, the model in use is the one you chose, and cost tracks actual usage rather than enrollment.
1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University.
ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.
Related: Open-Source AI Models and K-12 Data Privacy · The Student Data Problem With AI Vendors in K-12 · AI Cost Math for K-12 Districts